Loading article...
Loading article...
Stream/Area:
-
Subject:
-
Paper ID:
IJSREM66473
Volume:
10 |
8 |
Aug 2026
Pages:
1-7
Publication Frequency:
Monthly (12 issues per year)
License:International Journal of Scientific Research in Engineering and Management follows the Creative Commons Attribution 4.0 (CC BY 4.0) License, allowing free use and distribution with proper attribution.
Department of Faculty of Computing and IT
G M University, Davanagere
Department of Faculty of Computing and IT
G M University, Davanagere
Blogging platforms are everywhere now, but not all of them get the basics right — security and ease of use often end up as trade-offs instead of going hand in hand. That's the gap this project tries to close. Built on Node.js, Express.js, MongoDB, and Mongoose, the application lets users sign up, log in through a session-based system, and manage their own blog content from start to finish — writing posts, uploading images, updating profile details, and interacting with others via comments, likes, and reactions. On the security side, there's also a two-factor authentication layer, loosely based on the TOTP model, added to make accounts harder to compromise. Rather than dumping everything into one file, the app keeps things separated — routes, database models, and views each live in their own space. Auth and session logic sit apart from the blog and comment routes, and the Mongoose schemas for users, posts, and comments are kept in their own folder too. It's not just neatness for its own sake — when something breaks, it's usually obvious right away whether the problem's in a route, a schema, or the template rendering it. What sets this write-up apart from a typical implementation report is the deeper dive afterward. It looks at where the system could realistically be attacked, walks through the defenses put in place (mostly following OWASP's recommendations), lays out the database design in more depth, and tests how the app holds up under load. None of this is theoretical — it's meant to show, practically, how the platform behaves once real security and performance pressures come into play. At the end of the day, this is a small but solid system — secure logins, manageable content, a bit of personalization, and nothing bloated. It works well for a college project, a personal blog, or even a small community site. And the way it's been tested and evaluated here could be genuinely useful for anyone else trying to build something similar down the line.
KEYWORDS
This paper set out to design and build a secure, session-based blogging platform using Node.js, Express.js, MongoDB, and Mongoose. Along the way, the system ended up bringing together quite a few pieces user authentication, session management, profile customization, media uploads, blog publishing, comments, likes, reactions, and two-factor authentication all wired into a modular architecture that should be reasonably easy to extend later on. Based on the functional and security evaluations, the platform holds up well as a secure web-based content management system, without adding unnecessary complexity to deploy or maintain. The security mechanisms in place genuinely help with data protection and reliability, so the platform is a good fit for educational projects, personal use, and small community publishing it's not meant for enterprise-scale deployments. There's still clear room to grow, though: better scalability, role-based access control, a move toward cloud deployment, further security hardening, and a few more advanced features to round out performance and usability. And more broadly, the architecture itself could work as a starting point for other secure web apps that don't need a lot of extra complexity. Hopefully, the work here can be useful as a reference point for others building or researching secure web applications.
[1] Node.js Foundation, "Node.js," [Online]. Available: https://nodejs.org/. Accessed: Jul. 2026. [2] Express.js, "Express.js — Fast, Unopinionated, Minimalist Web Framework for Node.js," [Online]. Available: https://expressjs.com/. Accessed: Jul. 2026. [3] Mongoose, "Mongoose ODM," [Online]. Available: https://mongoosejs.com/. Accessed: Jul. 2026. [4] bcryptjs, "bcryptjs," [Online]. Available: https://www.npmjs.com/package/bcryptjs. Accessed: Jul. [5] D. M'Raihi, S. Machani, M. Pei, and J. Rydell, "TOTP: Time-Based One-Time Password Algorithm," RFC 6238, 2011. [6] OWASP Foundation, "OWASP Top Ten," [Online]. Available: https://owasp.org/www-project-top-ten/. Accessed: Jul. 2026. [7] MongoDB, Inc., "MongoDB Manual," [Online]. Available: https://www.mongodb.com/docs/. Accessed: Jul. 2026. [8] OpenJS Foundation, "Multer: Node.js middleware for handling multipart/form-data," [Online]. Available: https://www.npmjs.com/package/multer. Accessed: Jul. 2026. [9] FIDO Alliance / W3C, "Web Authentication: An API for accessing Public Key Credentials," W3C Recommendation, 2021. [Online]. Available: https://www.w3.org/TR/webauthn-2/. OWASP Foundation, "OWASP Application Security Verification Standard (ASVS)," [Online]. Available: https://owasp.org/www-project-application-security-
Publication Date
8/3/2026
Peer Review Type
Double-Blind Peer Review
Review Rounds: 2
Documents
Article Views
0
Total views since publication
PDF Downloads
11
Total downloads since publication
Geographic Reach
5
Digital Preservation: This article is permanently archived on Zenodo and complies with all data preservation standards across major indexing platforms.
Plagiarism Screening
This manuscript has been checked for plagiarism using TurnitinPlagiarismChecker software.
Conflict of Interest
The authors declare no conflict of interest related to this research work.
Funding Information
No funding information available for this research.
Related research in the same subject area
Loading similar articles...